---
sidebar_label: Token file
description: Token File Method for OpenBao Auto-Auth
---

# OpenBao Auto-Auth token file method

:::warning

Note: This authentication method is tailored for the development experience,
and to facilitate getting started with OpenBao Agent and OpenBao Proxy. OpenBao Agent and
OpenBao Proxy should never be configured to use this auto-auth method in a production environment.

:::

The `token_file` method reads in an existing, valid OpenBao token from a file, and uses that
token in lieu of authenticating itself. While it's a first class auto-auth method for all intents
and purposes, it naturally doesn't authenticate itself, as it requires a token from elsewhere. Like
other auto-auth methods, this method will attempt to renew the token, as appropriate.

This auto-auth method is especially useful when testing OpenBao Agent or OpenBao Proxy without needing to set up
any authentication methods in OpenBao. For long-running Agent or Proxy processes, we strongly recommend another
auto-auth method, such that Agent and Proxy are issuing their own own authentication requests to OpenBao.

## Configuration

- `token_file_path` `(string: required)` - The path to the file with the token inside. This token cannot be a wrapping token.

## Example configuration

An example configuration for OpenBao Agent, using the `token_file` method to enable [auto-auth](/docs/agent-and-proxy/autoauth), follows:

```hcl
pid_file = "./pidfile"

vault {
  address = "https://127.0.0.1:8200"
}

auto_auth {
  method {
    type = "token_file"

    config = {
      token_file_path = "/home/username/.vault-token"
    }
  }
}


api_proxy {
  use_auto_auth_token = true
}

listener "tcp" {
  address = "127.0.0.1:8100"
  tls_disable = true
}

template {
  source      = "/etc/openbao/server.key.ctmpl"
  destination = "/etc/openbao/server.key"
}

template {
  source      = "/etc/openbao/server.crt.ctmpl"
  destination = "/etc/openbao/server.crt"
}
```
